Previously known as MAMIP (Monitor AWS Managed IAM Policies).
Track every change to AWS Managed IAM Policies with full version history and validation.
Explore AWS Managed IAM Policies through a searchable web interface at iamtrail.com:
- Search and filter across 1,465+ managed policies
- Full version history with git diffs for every policy
- Syntax-highlighted JSON policy viewer
- New (v1) policy tracking to spot new AWS services
- Policy validation findings from AWS Access Analyzer
- Known AWS Account lookup - identify who owns one or a whole list of AWS account IDs, powered by the fwdcloudsec/known_aws_accounts community dataset
Subscribe to policy changes:
- Email Digest (recommended): Subscribe on iamtrail.com - daily or weekly emails with inline diffs, per-policy filtering, no account required
- Bluesky (unified feed - IAM policies, endpoints, GuardDuty): @iamtrail.bsky.social
- RSS Feeds (all feeds):
- All Changes - everything in one feed
- IAM Policy Changes - policy updates, new policies, deprecations
- Endpoint Changes - new regions, services, and expansions from botocore
- GuardDuty Announcements - new findings, features, and region launches
See docs/notifications-and-social.md for SSM parameters, Bluesky queue, and GitHub Actions IAM.
All policies are stored as JSON in this repository and updated automatically every hour on weekdays.
| Path | Description |
|---|---|
policies/ |
1,465+ current AWS Managed IAM Policies |
findings/ |
Access Analyzer validation results |
DEPRECATED.json |
Historical record of 73+ deprecated policies |
The whole archive is also published as versioned JSON at https://iamtrail.com/api/v1. No key, no sign-up, no rate limit - these are static files on the same CloudFront distribution that serves the site. Full documentation at iamtrail.com/api.
| Resource | Description |
|---|---|
/api/v1/index.json |
Service index: contract version, counts, and the URL of every other resource |
/api/v1/policies.json |
Every tracked policy with its ARN, current version and dates |
/api/v1/policies/{policyName}.json |
One policy: current IAM document plus full version history with per-version action deltas |
/api/v1/changes.json |
Recent changes, each naming the actions added and removed |
/api/v1/actions.json |
Every literal IAM action mapped to the policies that allow, deny or NotAction it |
/api/v1/discoveries.json |
Actions and service prefixes seen for the first time anywhere in the archive |
# What changed in the last day
curl -s https://iamtrail.com/api/v1/changes.json \
| jq -r '.changes[]
| select(.date > (now - 86400 | todate))
| "\(.policyName) \(.versionId): \(.summary)"'Fields are added, never removed or repurposed, within a version. A breaking change means a new path under /api/v2/.
An automated workflow runs every hour (Mon-Fri):
- Fetch all AWS Managed IAM Policies via the AWS API
- Detect new, updated, or deprecated policies
- Validate each policy with AWS Access Analyzer
- Commit changes to git (one commit per policy)
- Notify via Bluesky, RSS, email digests, and an invite-only Discord webhook (SSM only, not linked on the site)
Inspired by Scott Piper's original aws_managed_policies repository. Thank you, Scott, for pioneering this.
GNU General Public License v3.0 - see LICENSE for details.
